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mSCOA Project Risk: Examples 


CATEGORY 

DESCRIPTION OF THE RISK 

Non-compliance 

The possibility of the municipality not achieving full compliance by 1 July 2017, 
should be the top risk in every mSCOA project risk register. 

System failure 

Although the system vendors are doing their best to support municipalities in 
achieving compliance with the regulations, there is always the chance that the 
system might fail and compliance be negatively impacted. This risk should be 
included in the risk register. 

Audit outcome 

For any municipality, mSCOA project failure or weak project controls could have 
an adverse impact on the existing audit findings. This risk should be highlighted 
in the risk register and closely monitored to mitigate the impact. 

Demarcation impact 

The demarcation of municipal borders in view of the coming elections could 
impact on the mSCOA implementation and affected municipalities should note 
the risk, and initiate mitigation plans and activities to deal with the risk in a pro- 
active fashion. 

Requirements 

Requirements should be clearly specified. The level of specification determines 
the level of risk, that is vague specifications increase the risk and very clear 
specifications reduce the risk. 

Benefits 

Business benefits should be identified and quantified, informing the business 
case for change or implementation. If there is a very clear business case, it 
reduces the overall risk, and if the benefits are not clearly articulated and 
communicated, it poses an increased risk. 

Schedule 

Schedule lists of all activities and tasks with enough time to complete, provide 
accurate dependencies and assign responsibilities. Detailed schedules reduce 
the risk, whilst vague and un-assigned schedules of activities increase the risk. 

Budget 

Sufficient budget should be allocated for all the components of the project and 
accountability therefore assigned. If the budget is sufficient to cover the entire 
project, the risk is mitigated. Insufficient budget to complete the project should 
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be highlighted as a key risk. 

Deliverables 

Clearly defined deliverables with quality and acceptance criteria, reduce the risk 
whilst vague deliverables, or omission of the quality and acceptance criteria, 
increase the risk. Deliverables and acceptance criteria form the basis of 
contracting if vendors are utilised for any part of the project delivery. 

Scope 

Clearly outlined scope reduces the risk and enables containment of scope creep, 
which in turn impacts on the budget and time line. 

Issues 

The Issue log documents all issues and key decisions on the project, including 
the information which was considered to make these decisions, who made 
them, and what the implications of these decisions are. This document is 
reviewed by auditors and informs future developments and projects. 

Suppliers 

Municipalities may decide to use the services of vendors and suppliers in 
support of mSCOA implementation. Expectations and reporting lines for 
suppliers should be clearly defined and the municipality should manage the 
suppliers, and not the suppliers manage the process or the municipality. Penalty 
clauses and performance standards should always be included in supplier 

contracts. 

Acceptance criteria 

Acceptance criteria, quality expectations and the process for acceptance of 
deliverables should be clearly defined and agreed with all project team 
members, internal and external. Clearly defined criteria reduce project risk. 

Communication 

Communication is the cornerstone of successful project implementation and 
should be planned for the duration thereof. Controlled communication to the 
project team, vendors, affected parties and other stakeholders reduces the risk 
to the project. 

Resources 

Resources for the project include skilled staff, budget and technology. The 
oversight committee and project team should be allocated and assigned in 
writing, including the amendment of their respective performance contracts, to 
ensure that this project is their priority and reduce the risk of not meeting the 
compliance requirements. 


